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ABSTRACT 


The Huntsville Simulation Laboratory (HSL) provides a simulation facility to test and verify the 
Space Shuttle Main Engine (SSME) avionics and software system using a maximum complement of flight- 
type hardware. The HSL will permit evaluations and analyses of the SSME avionics hardware, software, 
control system, and mathematical models. It is a unique facility in its authenticity as well as in 
the complexity and scope of simulation. The laboratory has performed a wide spectrum of tests and 
verified operational procedures to ensure system component compatibility under all operating condi- 
tions. It is a test bed for integration of hardware/software/hydraulics. The HSL is and has been 
an invaluable tool in the design and development of the SSME. 

INTRODUCTION 


Simulation has been an invaluable tool in design and development of the SSME. Usages of 
simulation techniques are numerous and range from component design parameter definition and digital 
control design to operating software design, development, and verification. 

The SSME, three of which provide primary thrust for the NASA Orbiter vehicles, incorporates many 
advanced features including a programmable digital control system (1). Control is accomplished with 
an engine-mounted electronic digital control system packaged in a single assembly called the 
controller. The controller contains dual programmable computers with 16,000 memory words for each 
computer. The controller, in conjunction with five hydraulically aetuated propellant valves, 43 
performance, limit, position and maintenance sensor inputs and six solenoid control valves, accepts 
vehicle commands for the SSME operational phases, positions the appropriate valves, monitors the 
engine for performance conditions and provides redundancy management (2 and 3) . The relationship 
of the engine avionics to the Orbiter vehicle is shown in a simplified manner in Figure 1. 

The SSME control system provides checkout, start, mainstage operation and shutdown in response 
to vehicle commands. The control system also has the capability to check out and monitor its own 
status and to monitor and report engine status conditions while maintaining full redundancy 
management. The software used by the controller to accomplish the noted functions must be designed, 
tested and verified to satisfy the system requirements. It is extremely important that software 
discrepancies or errors be identified and corrected before the software is used by the SSME to avoid 
engine or vehicle damage. 

The HSL located at Marshall Space Flight Center (MSFC) provides a program-unique capability of 
simulating SSME system operation at nominal and off-nominal conditions. The simulation provides the 
capability of perturbating variables of software, hardware or internal engine operations to determine 
the SSME system response in all modes of operation. 

The present primary usage of the HSL is the design, development, and verification of the SSME 
controller software. Other program uses of the facility include systems integration, system 
characteristics definition, control system dynamic response definition and verification, and pro- 
blem resolution support to Kennedy Space Center (KSC) and engine test sites. The operational soft- 
ware that is used for SSME single engine testing. Main Propulsion Test Article (MPTA) testing and 
KSC flight vehicle operation is verified at the HSL prior to usage. Thus errors or conflicts are 
identified in a benign environment without program impact. The SSME software is flown tens of times 
at the HSL before usage is authorized for flight operation. 
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FIGURE 1 


SIMULATION FACILITY 


The need for a hardware simulation facility which incorporated a maximum complement of avionics 
hardware was recognized early in the SSME program. NASA/MSFC started the initial facility design 
efforts in the early 1970’ s, and the HSL was declared operational in 1975. 

The hardware simulation incorporates as many flight components and functional stimuli as are 
practical for the extensive testing required for system and subsystem analysis, validation, and 
verification. A maximum hardware complement is used in conjunction with the hybrid simulation to 
perform the following system tests: 

a. Hardware Integration 

b. Software Integration 

c. Failure Mode and Parameter Anomaly Evaluation 

d. System Dynamic Validation 

e. Sensitivity Analysis 

f. Special Effects Analysis 

g. Live Engine Correlation 

The hardware simulation must be capable of cycling all phases of engine operation, including purge 
sequences, startup, mainstage, shutdown, and post -shutdown . 

The HSL can be divided into three major elements as shown in Figure 2. The elements are the 
engine dynamic model, a complement of flight configuration hardware, and a simulation control center. 

Engine Dynamic Model - Hybrid Computer 

A hybrid simulation of the SSME is programmed on two C 15000 analog computers and one SEL 840 MP 
digital computer. This simulation was developed from the mathematical models specified in the 
Engine Balance and Dynamic Model Specification (RL00001) and the Engine Control Design Document 
(RSS-8551). This simulator is programmed such that it will operate independent of or with any subset 
of the flight-type hardware contained in the Simulation Laboratory Control Room. The engine, actu- 
ators, and sensors are simulated on the analog computers. The digital computer is used to simulate 
the main engine controller and to handle initialization and timing functions. In the all-software 
mode, the simulation is used to evaluate and validate the mathematical models. In the standard 
operating mode, the hybrid simulation supplies the engine internal pressure and temperature parameter 
values to the Simulation Control Room where they are interfaced with the -SSME Controller, Figure 3. 

A new dual AD-10 digital simulator using a DEC host will be brought on-line to replace the classic 
Hybrid. 

An engine simulation model of lower fidelity has been programmed on a PDP 11/34 computer to 
provide a backup to the hybrid simulation. This backup enables continuation of HSL testing during 
hybrid computer maintenance operations. 

Flight Configuration Hardware 

Flight configuration SSME avionics hardware usage is maximized at the HSL to gain simulation 
fidelity. The major elements are a flight configuration SSME controller and propellant valve 
hydraulic actuators. The SSME has five propellant control valves which are hydraulically actuated 
These five hydraulic actuators are incorporated into the simulation facility and integrated into the 
control system in the same manner as they are used by the SSME. 

The HSL also includes spark igniters, instrumentation sensors, control solenoids, propellant 
bleed valves and a pneumatic control assembly. A detailed list of SSME avionics hardware is in- 
cluded in Figure 4. 

Simulation Control Center 


The simulation control center interfaces the HSL elements and acts as the command center for 
testing. The center contains a Command and Data Simulator (CADS), test consoles, hydraulic actu- 
ator load system, and a support system consisting of data recording/display and diagnostic tools 
(Figure 3). 
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A test is initiated with commands from the CADS to the SSME controller, SSME actuator positions 
are sent to the Engine Dynamic Model which then supplies the sensor stimuli representing engine 
internal parameters to the SSME controller. The controller outputs data and status to the CADS and 
data recordings are made for further analysis. 

Command and Data Simulator 

The Command and Data Simulator (CADS) contains a digital computer that interfaces directly with 
the main engine controller. It is used to simulate the Orbiter vehicle interface. The two primary 
functions of the CADS are to send commands to the controller and receive and record from the 
controller. 


Test Consoles 

Power-up, testing, and monitoring of all simulation flight hardware are controlled from the 
consoles located in the Simulation Laboratory Control Room. The consoles include the capability of 
fault insertion. Manual switch control is provided for SSME controller input and output lines. Thus, 
in the case of engine control parameters, such as thrust chamber pressure where multiple sensor in- 
puts are used, failure insertion can be accomplished to fail maximum, fail minimum, fail mid-range, 
or insert a bias between sensor inputs. In the case of propellant valve actuators, the fault insert- 
ion can be loss of command signal to the actuator or loss of position signal from the actuator. 

Hydraulic/Actuator Load System 

The five primary propellant valves on the SSME are controlled by hydraulic actuators. The 
facility hydraulic system provides 3,000 psi pressure at the SSME required flowrate. Hydraulic 
supply and return lines are sized to simulate the engine lumped line inertia to enable testing of 
fluid system transients. During mainstage operation, the actuators are under dynamic stress due to 
the flow of fuel or oxidizer through their respective valves. In order to simulate this loading, a 
load actuator is coupled to each primary valve actuator. The load actuators are controlled by the 
hybrid computer and can apply a physical load to the primary valve actuators that is representative 
of the dynamic loading that will be experienced during actual engine operation. 

Simulation Support System 

The HSL includes the following Simulation Support System to accomplish data recordings, simulator 
(program) handling, input features, and diagnostic tools: 

a. Data Recording 

(1) Strip-Chart Recorders 

(2) Real-Time Printer 

(3) Magnetic Tape 

b. Data Display CRT 

c. Predetermined Initialization Input 

d. Diagnostic Software 

e. PDP/11-34 Computer for Data Analysis 

f. History Memory System 

g. Power Transient Generator 


MAJOR PROGRAMMATIC BENEFITS 


Avionics and Systems Integration 

A facility such as the HSL enables the first-time integration of controls and system in a 
supportive test environment. The HSL has served as the site for initial integration of the SSME 
controller to the the control system sensors, hydraulic actuators, pneumatic solenoids, the Orbiter 
Engine Interface Unit (EIU), and the Flight Accelerometer Safety Cutoff System (FASCOS) . 
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The FASCOS development effort is an excellent example of maximum utilization of simulation 
facilities for systems integration. The first FASCOS unit built was a rack-mounted breadboard. 
Following build and laboratory checkout, the FASCOS breadboard was connected to a SSME controller 
for the first time at the HSL. Initial testing verified interfaces and FASCOS hardware function. 

The breadboard was then used for development and initial verification of the controller software. 

A prototype FASCOS unit of the engine-mounted configuration was built and that unit was also inte- 
grated with the SSME controller at the HSL. Formal verification of the controller software was 
conducted at the HSL using the prototype unit. The prototype, together with the verified software, 
were then exposed to single engine hot-fire testing. Usage of simulation facilities resulted in 
of the FASCOS configuration into the SSME with avoidance of any delay at the test site due to 
hardware or software integration problems. 

Integration tests have also been conducted at the HSL to define engine hydraulic system pressure 
transients for the Orbiter system. These simulations of the SSME hydraulic system operation verified 
engine/orbiter interface pressure level limits and worse-case surge pressure transient response with 
maximum propellant valve excursion rates. 

Software Change Verification 

The SSME control system provides flexibility due to the programmable digital logic. Thus changes 
in operational sequence, function, limits, and redundancy management can be readily incorporated as 
knowledge is gained throughout the engine testing and flight operation program. 

These software changes are all subjected to verification testing at the HSL prior to engine 
usage. The philosophy of change verification is to expose the avionics hardware and software systems 
to a simulation of the expected as well as possible conditions. For example, if a change were to be 
desired in combustion chamber pressure data processing to enhance redundancy management, verification 
would require off-nominal and malfunction conditions as well as the expected operating profiles. The 
HSL verification of such a change would entail normal start, mainstage, throttle up and down, and 
shutdown operating mode simulations. Off-nominal testing would involve simulating bias of sensor 
outputs and evaluation of control system discrimination. Malfunction testing would involve simulat- 
ion of single and multiple sensor input failures. This testing would be accomplished using the 
change in conjunction with the operational software configuration. Results of these simulations are 
evaluated to ensure that operating characteristics and requirements of the SSME are satisfactory. 
Satisfactory results can be incorporated into engine testing and flight operations. Conversely, if 
undesirable results are obtained, the software design can be corrected without having endangered 
engine or vehicle operation. 

Launch Support and Problem Resolution 

The HSL has proven a valuable resource in the prompt resolution of problems experienced at KSC. 
Use of the facility for this purpose allows simulation and resolution of the problem and development 
and proofing of backout procedures or corrections with minimum impact on the operational site. 

An example of this was the supplementing of the Huntsville Operational Support Center (HOSC) 
during the initial launch attempt for STS-1. During that operation, improper positioning of an 
Orbiter cockpit switch resulted in generation of SSME Failure Identifications (FID's). Discussion of 
FID’s between the HOSC and HSL personnel resulted in identification of the probable cause as a SSME 
input power failure. The HSL simulated a power failure and produced the identical FID’s experienced 
at KSC. A procedure for restoration of power to the SSME controller was developed and verified at 
the HSL. HOSC reviewed HSL results and concurred with the procedure. HOSC communications with KSC 
confirmed the error in switch positioning, reported the HSL simulation results, and transmitted to 
KSC the verified power-up procedure. This entire scenario occurred in less than one hour and avoided 
launch delay. 

Another typical example occurred during preparation for FRF-2 for STS-6. Engine position two 
experienced two HALT’S and required usage of the ground support equipment memory loader to recover. 
The HSL simulation capabilities were used to duplicate the HALT condition and to aid site personnel 
in restoring SSME controller operation. Further simulation testing at the HSL resulted in identifi- 
cation of the cause of the HALT condition, a correction for the problem and a procedure for avoid- 
ing the condition. Usage of the HSL in this manner resulted in minimization of the time required to 
restore operating conditions at KSC and avoidance of a schedule delay which would have resulted if 
the launch site had been required for the extensive testing required to identify the problem cause 
and its resolution. 
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Engine System Malfunction Analysis 


The fidelity of the HSL, including the engine model and hardware/software system response, 
enables usage of the facility for malfunction analyses of the SSME system. Examples of this usage 
include evaluation of thrust chamber coolant tube rupture and chamber pressure sensor port blockage 
effects upon engine system operation. 

In the evaluation of the effect of a nozzle tube rupture, the hybrid computer analog model was 
changed to simulate an overboard bleed flowrate from the thrust chamber nozzle fluid circuit. The 
bleed flowrate could be varied from one to ten pounds per second. Flight simulation runs were then 
conducted using varying bleed flowrates to determine the engine control system response, with special 
emphasis on position changes of the preburner valve actuator position relative to operating limits. 

The simulation of the effect of chamber pressure sensor port blockage was accomplished by using 
the test console features which allowed biasing a pair of sensor outputs. Flight simulation runs 
were then conducted using pre-set biases to determine the effect upon engine system operation. 

FUTURE APPLICATIONS 


The HSL will continue to be utilized in the SSME program in its current role, with emphasis on 
KSC launch support and software verification. Launch support responsibilities will be expanded as 
Vandenberg Air Force Base (VAFB) becomes operational as a Space Shuttle launch site. 

SSME controller piece part obsolescence has resulted in the requirements for a Block II controller 
fpr future engine deliveries. This controller will require a different set of software. Formal 
validation and verification of the Block II software will be major HSL activity in the late 1980 
time period. The flexibility of the HSL design will allow usage of the facility to support both sets 
of software with minimal facility modification. 
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